CCC-A flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

NIST essential characteristics

Five traits define cloud: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. A model lacking any one of these is not cloud under the NIST definition.

IaaS responsibility boundary

The provider manages facilities, hardware, network, and hypervisor. The customer manages the guest operating system, middleware, runtime, applications, and data, including patching and hardening of everything above the hypervisor.

PaaS responsibility boundary

The provider manages infrastructure plus operating system and runtime. The customer manages only applications, configuration, and data, which reduces operational overhead but limits control over the underlying platform.

Elasticity versus scalability

Scalability is the capacity to handle growth. Elasticity is automated, demand-driven scaling up and down. Every elastic system is scalable, but a scalable system that requires manual resizing is not elastic.

Hybrid cloud definition

Two or more distinct deployment models joined by technology enabling data and application portability. A private data center with a VPN to public cloud counts only if workloads actually move or are orchestrated across both.

Measured service metering

Cloud systems automatically control and report resource use, providing transparency to provider and consumer. Typical metering units are vCPU-hours, GB-months of storage, and GB of data transferred.

Cloud bursting

A hybrid pattern where a private environment handles baseline load and overflows peak demand to public cloud. It requires stateless or externally stored session state so instances can appear and disappear safely.

The 6 Rs of migration

Rehost (lift and shift), replatform (lift, tinker, and shift), refactor or re-architect, repurchase (move to a different product), retain (keep for now), and retire (decommission). Retire is often the cheapest win.

Total cost of ownership in cloud

TCO sums run-rate plus migration, dual-running during cutover, retraining, egress, and decommissioning costs. Omitting exit and transition costs understates cloud cost and biases the comparison.

Cloud Center of Excellence

A cross-functional team that owns cloud standards, guardrails, reference architectures, and reusable patterns. An effective CCoE enables delivery teams with self-service rather than acting as an approval gate.

Payback period formula

Payback period equals initial investment divided by annual net benefit. It is simple and intuitive but ignores cash flows after the break-even point and ignores the time value of money.

Net present value decision rule

NPV discounts all future cash flows to present value using a chosen discount rate. A positive NPV means the initiative adds value; between competing options, the higher NPV is preferred.

Data gravity effect

Large datasets attract applications and services toward them because moving data is slow and metered. Placing compute near the data usually costs less than replicating or egressing the dataset.

Availability Zone isolation

An AZ is one or more discrete data centers with independent power, cooling, and networking inside a region. Multi-AZ deployment survives a single data center failure; a regional disaster requires multi-Region.

Containers versus virtual machines

Containers share the host kernel and isolate at the process level, so they start faster and pack denser. Virtual machines run separate kernels on a hypervisor, giving a stronger isolation boundary.

Composite availability calculation

For components in series, total availability is the product of each component's availability. Chained dependencies therefore yield availability lower than the weakest single link, which argues for reducing serial depth.

Object storage characteristics

Object storage offers a flat namespace with HTTP APIs, high durability, and metadata per object. It suits unstructured data and backups but cannot serve as a low-latency database volume or POSIX file share.

Circuit breaker pattern

After a threshold of failures calling a dependency, the breaker opens and returns errors immediately instead of waiting. It prevents cascading failure and resource exhaustion, then probes for recovery.

Exponential backoff with jitter

Retries wait progressively longer between attempts and add randomized jitter. Backoff reduces load on a struggling dependency; jitter prevents synchronized retry storms from many clients at once.

Horizontal versus vertical scaling

Horizontal scaling adds more instances and suits stateless tiers with load balancing. Vertical scaling resizes one instance and is capped by the largest available instance type, often requiring downtime.

Security group versus network ACL

Security groups are stateful and attached to resources, allowing rules only. Network ACLs are stateless and attached to subnets, supporting both allow and deny rules evaluated in order.

OAuth versus OpenID Connect

OAuth 2.0 delegates authorization to access a resource without sharing credentials. OpenID Connect builds on OAuth 2.0 to add authentication, returning an ID token that asserts the user's identity.

Customer-managed keys

The customer controls key material, rotation policy, and revocation inside the provider's key service. This raises control and auditability over provider-managed keys while retaining provider operational convenience.

Least privilege implementation

Grant only the permissions required for a task, scoped to specific resources and conditions. Use roles and temporary credentials instead of long-lived access keys, and review permissions regularly.

Shift-left security

Security checks move earlier into design and CI pipelines, including infrastructure-as-code scanning and container image scanning. Defects found before deployment cost far less to remediate.

Cloud incident response phases

Preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned. Cloud adds dependence on provider notification channels and shared forensic evidence access.

Shared responsibility model

The provider secures facilities, hardware, and the hypervisor. The customer always owns data classification, identity and access management, and configuration of its own workloads, regardless of service model.

Policy as code guardrails

Compliance rules are expressed as machine-evaluated policies. Preventive controls block noncompliant provisioning, detective controls flag existing resources, and corrective controls remediate drift automatically.

SLA SLO and SLI

An SLA is the contractual commitment with remedies. An SLO is the internal measurable target. An SLI is the actual measured value. Error budget equals one minus the SLO.

Mandatory tagging strategy

Define required keys such as owner, cost center, environment, and data classification. Enforce them at provisioning so chargeback, ownership, and governance reporting remain accurate and complete.

Configuration drift

The divergence of deployed resources from the approved baseline. Detection compares live state to the infrastructure-as-code source of truth, and reconciliation reapplies the baseline.

FinOps cycle

Inform, optimize, and operate. Inform gives visibility and cost allocation, optimize covers rightsizing and commitment purchases, operate runs budgets, anomaly alerts, and continuous review with engineering.